5 ms·

My company does not allow any employees to use their personal GitHub for work (or Facebook, instagram, or anything else) after running into issue when employees

by l72 2y ago

My company does not allow any employees to use their personal GitHub for work (or Facebook, instagram, or anything else) after running into issue when employees leave.

booi 2y ago
Wouldn’t you just remove them from the org?
- onionisafruit 2y ago
  They may decide to change their github login to <company_name>LIES, and suddenly that’s all over your old PRs and Issues. Including in public repos where customers go looking for help.
  - TheDong 2y ago
    That's even more true with a dedicated work github account than a mixed personal/work one; either way they can still login and edit the account name even if removed from the company org, and if it's not shared it doesn't burn their personal account too... right? Is this speaking from experience?
    - deleted 2y ago
      [deleted]
    - wlesieutre 2y ago
      With a dedicated work account the organization can always take over the account (via reset email if need be, since they own your work email account) and do whatever they want with it
      - rendaw 2y ago
        A dedicated work account _where you use your work email address_... that was the missing part throughout this thread. But then if you do that you also lose all your open source work history, which is important from a hiring/resume perspective.
        cdogl 2y ago
        One option for those so inclined is to cryptographically sign commits with a key that lists both work and personal email address (assuming your enterprise’s policy allows it). The employer retains control but you have a claim to credit for your work.
        tsimionescu 2y ago
        If we're discussing companies willing to go to lengths to scrub you from their GitHub history, they can still replace all commits you've signed with new commits. You likely have no legal rights to that work, and git does allow you to rewrite history arbitrarily.
        shiomiru 2y ago
        > git does allow you to rewrite history arbitrarily. Technically yes, but the price is too great - everybody who has cloned the repos will now have to nuke their local copies too.
        tsimionescu 2y ago
        Sure, but the same is true for unsigned commits as well, isn't it? Or can you modify the commit metadata without changing the commit hash in those cases?
        shiomiru 2y ago
        > Sure, but the same is true for unsigned commits as well, isn't it? Yes, I think so. As I understand, GP's idea was to sign your commits proactively.
        tsimionescu 2y ago
        My question was, is signing the commits really useful? Isn't it just as hard or easy to scrub you from the repo history regardless of whether the commits are signed or not?

by l72 2y ago

My company does not allow any employees to use their personal GitHub for work (or Facebook, instagram, or anything else) after running into issue when employees leave.

booi 2y ago

Wouldn’t you just remove them from the org?

onionisafruit 2y ago
They may decide to change their github login to <company_name>LIES, and suddenly that’s all over your old PRs and Issues. Including in public repos where customers go looking for help.
- TheDong 2y ago
  That's even more true with a dedicated work github account than a mixed personal/work one; either way they can still login and edit the account name even if removed from the company org, and if it's not shared it doesn't burn their personal account too... right? Is this speaking from experience?
  - deleted 2y ago
    [deleted]
  - wlesieutre 2y ago
    With a dedicated work account the organization can always take over the account (via reset email if need be, since they own your work email account) and do whatever they want with it
    - rendaw 2y ago
      A dedicated work account _where you use your work email address_... that was the missing part throughout this thread. But then if you do that you also lose all your open source work history, which is important from a hiring/resume perspective.
      - cdogl 2y ago
        One option for those so inclined is to cryptographically sign commits with a key that lists both work and personal email address (assuming your enterprise’s policy allows it). The employer retains control but you have a claim to credit for your work.
        tsimionescu 2y ago
        If we're discussing companies willing to go to lengths to scrub you from their GitHub history, they can still replace all commits you've signed with new commits. You likely have no legal rights to that work, and git does allow you to rewrite history arbitrarily.
        shiomiru 2y ago
        > git does allow you to rewrite history arbitrarily. Technically yes, but the price is too great - everybody who has cloned the repos will now have to nuke their local copies too.
        tsimionescu 2y ago
        Sure, but the same is true for unsigned commits as well, isn't it? Or can you modify the commit metadata without changing the commit hash in those cases?
        shiomiru 2y ago
        > Sure, but the same is true for unsigned commits as well, isn't it? Yes, I think so. As I understand, GP's idea was to sign your commits proactively.
        tsimionescu 2y ago
        My question was, is signing the commits really useful? Isn't it just as hard or easy to scrub you from the repo history regardless of whether the commits are signed or not?